Final Patch of 2025: Critical SAP Solution Manager Flaw (CVE-2025-42880, CVSS 9.9) Risks Full System Compromise

According to SAP, the final security update of the year includes a critical Code Injection vulnerability in SAP Solution Manager (CVE-2025-42880) with a CVSS of 9.9, affecting the Solution Manager version ST 720 and posing a risk of full system compromise.

The patch bundle, released on 9 December 2025, warns that an authenticated attacker could insert malicious code when calling a remote-enabled function module, potentially gaining full control of the system and compromising confidentiality, integrity and availability.

Beyond this, the release also addresses a set of other high-severity issues, including Apache Tomcat vulnerabilities in Commerce Cloud (CVE-2025-55754, CVSS 9.6) and a high‑risk deserialization flaw in the SAP jConnect SDK for ASE (CVE-2025-42928, CVSS 9.1). Additional notable fixes include a Sensitive Data Exposure flaw (CVE-2025-42878) in SAP Web Dispatcher and ICM, two DoS vulnerabilities (CVE-2025-42874 and CVE-2025-48976), and a Memory Corruption issue (CVE-2025-42877). The article urges administrators to review and apply these updates to secure SAP landscapes ahead of 2026.